Is tencent/Hy3 safe to load?
CyberXYZ rates tencent/Hy3 CLEAN. No version-matched advisories and no malicious packages. It depends on 399 tracked packages, and 6 carry advisories. It does not require trust_remote_code.
INFOconfig.json was authored against transformers 5.6.0, which has known advisories. Consumers normally install a current version — this only bites if you pin for reproducibility.
1 more finding on this model.
- Author
- tencent
- Task
- text-generation
- Loader
- transformers
- License
- apache-2.0
- Downloads
- 837,193
- Remote code
- not required
29 direct, 19 with findings, 389 reachable
| Package | Evidence | Advisories | Worst |
|---|---|---|---|
| transformers | direct, runtime | 24 | none pinned |
| torch | direct, runtime | 13 | none pinned |
- HIGHvector new2026-09-09
- MEDIUMvector new2026-09-09
- MEDIUMrisk level raised (unknown to medium)2026-09-09
Is tencent/Hy3 safe to load?
CyberXYZ does not call a model safe in absolute terms. It rates tencent/Hy3 CLEAN. No version-matched advisories and no malicious packages. That covers its dependencies and how it loads, not every file it ships, so treat any check that did not run as unverified and check the exact files before you load them.
What does tencent/Hy3 depend on?
CyberXYZ tracks 399 dependencies for tencent/Hy3, 29 of them direct. 6 carry advisories. They include transformers and torch. A free account lists all of them.
Does tencent/Hy3 run code when it loads?
HuggingFace does not mark tencent/Hy3 as requiring trust_remote_code. That says nothing about the format of its weight files, which model_load_safety checks per file.
How do I check tencent/Hy3 before loading it?
Run the xyz MCP tool model_load_safety on tencent/Hy3 to get a verdict on its weight files before you load them, or search it in CyberXYZ Check at https://cyberxyz.io/check?q=tencent%2FHy3.
Risk computed 2026-11-14 at 13:05 UTC. Dependencies come from the model's requirements, its declared loader and the code it ships; advisories from NVD, GHSA and OSV.